From March, Check Point Research (CPR) sees a 257% jump in the number of sellers using Telegram to advertise fake vaccination cards to those “who do not want to take the vaccine”, as pressure to take the vaccine rises with the rapidly spreading Delta variant. For as low as $100, anyone can pay with cryptocurrency to purchase fake CDC, NHS and EU Digital COVID certificates, and more.
Check Point Research (CPR) sees exponential growth in market activity for fake coronavirus vaccine certificates, primarily on Telegram. For as low as $100, advertisements promise the EU Digital COVID certificate, CDC and NHS COVID vaccination cards, alongside fake PCR COVID-19 tests to anyone willing to pay. Sellers are organizing their services in groups on Telegram, with some groups exceeding 450,000 followers, as sellers view Telegram as a far more efficient means to scale distribution. Vaccination certificates for almost every country are available for purchase. The majority of the fake certificates are being sold from European countries.
In March 2021, CPR published a report that first detailed the trend of fake ‘vaccine passports’ being sold online across the darknet. Since then, CPR has continued to monitor the black market for activity around alleged coronavirus services.
The advertisements are specifically designed for people “who do not want to take the vaccine”. One advertisement exampled displayed “we are here to save the world from this poisonous vaccine.” The advertisements highlight the ability to travel and work freely as benefits of their product. Advertisements purport that their vaccination cards are registered and verified in the NHS and CDC system online, as well as the EU database.
Sellers mostly accept payments through PayPal and cryptocurrency (Bitcoin, Monero, Dogecoin, Litecoin, Ethereum and others). In some cases, Steam, Amazon and ebay gift-cards are accepted.
In March, the majority of the fake coronavirus certificates were advertised on the dark net. Now, CPR sees the majority of black market activity centered around Telegram. CPR suspects the shift to Telegram has helped sellers scale their distribution efforts, reaching more consumers, faster.
Oded Vanunu, Head of Products Vulnerabilities Research at Check Point, “We’ve been studying the darknet and Telegram for coronavirus related services all year. Right now, fake vaccination cards for almost all countries are now available for purchase. All you need to do is list the country you are from and what you want. Vendors are choosing to advertise and do business on Telegram because it scales their distribution. Telegram is less technical to use compared to the dark net and can reach an inordinate amount of people, fast. We believe the broader market surge is fueled by the rapidly spreading Delta variant and the stemming urgency for everyone to become vaccinated. In effect, there are people who don’t want to take the vaccine, but still want the freedoms that come with proving vaccination. These people are increasingly turning to the darknet and Telegram in scores. Since March, prices for fake vaccination cards have dropped by half and online groups for these fraudulent coronavirus services boast followings of hundreds of thousands of people. I strongly recommend people to no engage these sellers for anything, as these vendors are after more than just selling you fake vaccination cards.”